CVE-2026-92947
vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
Sandboxed code is able to disclose host memory used by small allocations by Buffer.from, Buffer.concat.
- No known exploitation
- Severity
- Critical, CVSS 10.0 (v3.1)
- EPSS
- 0.48% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- vm2 (npm) <= 3.11.6, fixed in 3.11.7 · GHSA-fcqc-726x-5wfc